# plug (Hex) vulnerabilities 8 known vulnerabilities (2 high, 2 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://hex.pm/packages/plug ## Advisories (8) ### [CVE-2026-105963](https://cve.now/CVE-2026-105963): Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments - Severity: Medium 5.1 - Published: Oct 23, 2026 - Affected: from 1.6.3, fixed in 1.7.0. ### [CVE-2026-56813](https://cve.now/CVE-2026-56813): Cookie attribute injection in Plug.Conn.Cookies.encode/2 - Severity: Low 2.1 - Published: Jul 10, 2026 - Affected: from 0.1.0, fixed in 1.16.6; from 1.17.0, fixed in 1.17.4; from 1.18.0, fixed in 1.18.5; from 1.19.1, fixed in 1.19.5; from 1.20.0, fixed in 1.20.3. ### [CVE-2026-56814](https://cve.now/CVE-2026-56814): Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service) - Severity: Medium 6.9 - Published: Jul 10, 2026 - Affected: from 1.4.0-rc.0, fixed in 1.16.6; from 1.17.0, fixed in 1.17.4; from 1.18.0, fixed in 1.18.5; from 1.19.1, fixed in 1.19.5; from 1.20.0, fixed in 1.20.3. ### [CVE-2026-54892](https://cve.now/CVE-2026-54892): Plug: quadratic-time decoding of nested query/body parameters enables denial of service - Severity: High 8.7 - Published: Jun 23, 2026 - Affected: from 1.15.0, fixed in 1.15.5; from 1.16.0, fixed in 1.16.4; from 1.17.0, fixed in 1.17.2; from 1.18.0, fixed in 1.18.3; from 1.19.0, fixed in 1.19.3; from 1.15.0, fixed in 1.15.5; from 1.16.0, fixed in 1.16.4; from 1.17.0, fixed in 1.17.2; from 1.18.0, fixed in 1.18.3; from 1.19.0, fixed in 1.19.3; from 1.15.0, fixed in 1.15.5; from 1.16.0, fixed in 1.16.4; from 1.17.0, fixed in 1.17.2; from 1.18.0, fixed in 1.18.3; from 1.19.0, fixed in 1.19.3. ### [CVE-2026-8468](https://cve.now/CVE-2026-8468): Unbounded buffer accumulation in multipart header parsing causes denial of service in plug - Severity: High 8.2 - Published: May 14, 2026 - Affected: from 1.4.0, fixed in 1.15.4; from 1.16.0, fixed in 1.16.3; from 1.17.0, fixed in 1.17.1; from 1.18.0, fixed in 1.18.2; from 1.19.0, fixed in 1.19.2; from 1.4.0, fixed in 1.15.4; from 1.16.0, fixed in 1.16.3; from 1.17.0, fixed in 1.17.1; from 1.18.0, fixed in 1.18.2; from 1.19.0, fixed in 1.19.2; from 1.4.0, fixed in 1.15.4; from 1.16.0, fixed in 1.16.3; from 1.17.0, fixed in 1.17.1; from 1.18.0, fixed in 1.18.2; from 1.19.0, fixed in 1.19.2. ### [CVE-2018-1000883](https://cve.now/CVE-2018-1000883): Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can… - Severity: Unrated - Published: Dec 20, 2018 - Affected: fixed in 1.0.6; from 1.1.0, fixed in 1.1.9; from 1.2.0, fixed in 1.2.5; from 1.3.0, fixed in 1.3.5. ### [CVE-2017-1000053](https://cve.now/CVE-2017-1000053): Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of… - Severity: Unrated - Published: Jul 13, 2017 - Affected: fixed in 1.0.4; from 1.1.0, fixed in 1.1.7; from 1.2.0, fixed in 1.2.3; from 1.3.0, fixed in 1.3.2. ### [CVE-2017-1000052](https://cve.now/CVE-2017-1000052): Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow… - Severity: Unrated - Published: Jul 13, 2017 - Affected: fixed in 1.0.4; from 1.1.0, fixed in 1.1.7; from 1.2.0, fixed in 1.2.3; from 1.3.0, fixed in 1.3.2. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/hex/plug Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.